Forum Komputery Wirusy, trojany, spyware
ZMIEŃ
    Dodaj do ulubionych

    Sprawdzanie loga hijack this

    IP: *.neoplus.adsl.tpnet.pl 05.12.05, 14:49
    Logfile of HijackThis v1.99.1
    Scan saved at 14:46:42, on 2005-12-05
    Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\AVPersonal\AVGUARD.EXE
    C:\Program Files\AVPersonal\AVWUPSRV.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\inet20096\services.exe
    C:\Program Files\AVPersonal\AVGNT.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\PROGRA~1\DAP\DAP.EXE
    C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
    C:\Program Files\Logitech\ImageStudio\LogiTray.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
    C:\Program Files\Internet Explorer\IExplore.exe
    C:\Program Files\Internet Explorer\IExplore.exe
    C:\Program Files\Internet Explorer\IExplore.exe
    C:\Program Files\Internet Explorer\IExplore.exe
    C:\Program Files\Internet Explorer\IExplore.exe
    C:\Program Files\Internet Explorer\IExplore.exe
    C:\Program Files\Internet Explorer\IExplore.exe
    C:\Program Files\Internet Explorer\IExplore.exe
    C:\Program Files\Internet Explorer\IExplore.exe
    C:\Program Files\Internet Explorer\IExplore.exe
    C:\Program Files\Internet Explorer\IExplore.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
    C:\Program Files\Internet Explorer\IExplore.exe
    C:\WINDOWS\inet20096\socks.exe
    C:\WINDOWS\inet20096\mm.exe
    C:\Program Files\Internet Explorer\IExplore.exe
    C:\Program Files\Internet Explorer\IExplore.exe
    C:\Program Files\Internet Explorer\IExplore.exe
    C:\Program Files\Internet Explorer\IExplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\magda\Pulpit\hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
    us.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://www.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    www.interia.pl/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
    www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
    us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
    us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
    us.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://www.yahoo.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    www.yahoo.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
    us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
    R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} -
    C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing)
    F3 - REG:win.ini: run=C:\WINDOWS\inet20096\services.exe
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
    C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: HBO Class - {5321E378-FFAD-4999-8C62-03CA8155F0B3} -
    C:\WINDOWS\inet20096\3.00.11.dll (file missing)
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1
    \SPYBOT~1\SDHelper.dll
    O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} -
    C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} -
    C:\Program Files\Yahoo!\Common\YIeTagBm.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
    C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -
    C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
    O4 - HKLM\..\Run: [6fqWqDb] C:\WINDOWS\mnvnvng.exe
    O4 - HKLM\..\Run: [tupqh] C:\WINDOWS\tupqh.exe
    O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
    O4 - HKLM\..\Run: [SearchUpgrader] C:\Program Files\Common
    files\SearchUpgrader\SearchUpgrader.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -
    atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP
    O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3
    \LVCOMS.EXE
    O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program
    Files\Logitech\ImageStudio\ISStart.exe
    O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program
    Files\Logitech\ImageStudio\LogiTray.exe
    O4 - HKLM\..\Run: [Onet.pl AutoUpdate] C:\Program Files\Common
    Files\Onet.pl\NewAutoUpdate.exe /tsr
    O4 - HKLM\..\Run: [vmlib] vmlib.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20096\services.exe
    O4 - HKLM\..\Run: [Microsoft standard protector] C:\WINDOWS\inet20096
    \socks.exe 20096
    O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
    O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web
    Folders\ibm00001.exe"
    O4 - HKCU\..\Run: [Skype] "C:\Program
    Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!
    \Messenger\ypager.exe" -quiet
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20096\services.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = ?
    O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840
    \dslmon.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program
    Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1
    \DAP\dapextie.htm
    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!
    \Common/ycsrch.htm
    O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1
    \DAP\dapextie2.htm
    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program
    Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!
    \Common/ycmap.htm
    O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!
    \Common/ycsms.htm
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} -
    C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} -
    C:\Program Files\IrfanView\Ebay\Ebay.htm
    O15 - Trusted Zone: arcaonline.arcabit.com
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Window
    Obserwuj wątek
      • Gość: k Re: Sprawdzanie loga hijack this IP: *.warszawa.sdi.tpnet.pl 05.12.05, 16:13
        Zainstaluj sobie AvantBrowser (Znajdziesz na google) zamiast otwierac tyle
        okienek IE.

        Odinstaluj:
        Logitech Desktop Messenger

        W menadzerze zadan zakoncz:
        C:\WINDOWS\inet20096\services.exe
        C:\WINDOWS\inet20096\socks.exe
        C:\WINDOWS\inet20096\mm.exe

        W hijackthis usun:

        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
        us.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*www.yahoo.com
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
        www.yahoo.com/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
        us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*www.yahoo.com
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
        us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*www.yahoo.com/ext/search/
        search.html
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
        us.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*www.yahoo.com
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
        www.yahoo.com/
        R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
        us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*www.yahoo.com
        R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} -
        C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing)
        F3 - REG:win.ini: run=C:\WINDOWS\inet20096\services.exe
        O2 - BHO: HBO Class - {5321E378-FFAD-4999-8C62-03CA8155F0B3} -
        C:\WINDOWS\inet20096\3.00.11.dll (file missing)
        O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
        O4 - HKLM\..\Run: [6fqWqDb] C:\WINDOWS\mnvnvng.exe <- usun plik
        O4 - HKLM\..\Run: [tupqh] C:\WINDOWS\tupqh.exe <- usun plik
        O4 - HKLM\..\Run: [SearchUpgrader] C:\Program Files\Common
        files\SearchUpgrader\SearchUpgrader.exe <- odinstaluj i usun katalog Search..
        O4 - HKLM\..\Run: [vmlib] vmlib.exe <- usun plik
        O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20096\services.exe
        O4 - HKLM\..\Run: [Microsoft standard protector] C:\WINDOWS\inet20096
        \socks.exe 20096
        O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web
        Folders\ibm00001.exe" <- usun plik
        O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20096\services.exe <- usun caly
        katalog inet20096

        Skan tym:
        download.ewido.net/ewido-setup.exe <- zrob update przed skanowaniem, po
        przeskanowaniu odinstaluj.

        Po wszystkim wklej nowy log bo ten sie nie zmiescil caly.
        • Gość: Madalenka Re: Sprawdzanie loga hijack this IP: *.neoplus.adsl.tpnet.pl 05.12.05, 19:07
          Zrobilam to co pisales, Co dalej??

          Logfile of HijackThis v1.99.1
          Scan saved at 19:04:20, on 2005-12-05
          Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\WINDOWS\Explorer.EXE
          C:\Program Files\AVPersonal\AVGUARD.EXE
          C:\Program Files\AVPersonal\AVWUPSRV.EXE
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\AVPersonal\AVGNT.EXE
          C:\Program Files\iTunes\iTunesHelper.exe
          C:\PROGRA~1\DAP\DAP.EXE
          C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
          C:\Program Files\Logitech\ImageStudio\LogiTray.exe
          C:\Program Files\Winamp\winampa.exe
          C:\Program Files\iPod\bin\iPodService.exe
          C:\WINDOWS\System32\wuauclt.exe
          C:\Program Files\Messenger\msmsgs.exe
          C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
          C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
          C:\Program Files\Avant Browser\avant.exe
          C:\Documents and Settings\magda\Pulpit\hijackthis\HijackThis.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
          www.interia.pl/
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
          O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
          C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
          O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1
          \SPYBOT~1\SDHelper.dll
          O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} -
          C:\Program Files\Yahoo!\Common\yiesrvc.dll
          O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} -
          C:\Program Files\Yahoo!\Common\YIeTagBm.dll
          O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
          C:\WINDOWS\System32\msdxm.ocx
          O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -
          atboottime
          O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
          O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP
          O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3
          \LVCOMS.EXE
          O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program
          Files\Logitech\ImageStudio\ISStart.exe
          O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program
          Files\Logitech\ImageStudio\LogiTray.exe
          O4 - HKLM\..\Run: [Onet.pl AutoUpdate] C:\Program Files\Common
          Files\Onet.pl\NewAutoUpdate.exe /tsr
          O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
          O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
          O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!
          \Messenger\ypager.exe" -quiet
          O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
          O4 - Global Startup: Adobe Reader Speed Launch.lnk = ?
          O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840
          \dslmon.exe
          O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
          O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!
          \Common/ycsrch.htm
          O8 - Extra context menu item: Blokuj wszystkie obrazy z tego serwera -
          C:\Program Files\Avant Browser\AddAllToADBlackList.htm
          O8 - Extra context menu item: Dodaj do listy blokowanych reklam - C:\Program
          Files\Avant Browser\AddToADBlackList.htm
          O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1
          \DAP\dapextie2.htm
          O8 - Extra context menu item: Otwórz wszystkie adresy z tej strony... -
          C:\Program Files\Avant Browser\OpenAllLinks.htm
          O8 - Extra context menu item: Podświetl - C:\Program Files\Avant
          Browser\Highlight.htm
          O8 - Extra context menu item: Szukaj - C:\Program Files\Avant Browser\Search.htm
          O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program
          Files\Yahoo!\Common/ycdict.htm
          O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!
          \Common/ycmap.htm
          O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!
          \Common/ycsms.htm
          O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} -
          C:\Program Files\Yahoo!\Common\yiesrvc.dll
          O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} -
          C:\Program Files\IrfanView\Ebay\Ebay.htm
          O15 - Trusted Zone: arcaonline.arcabit.com
          O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage
          Validation Tool) - go.microsoft.com/fwlink/?linkid=39204
          O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) -
          C:\Program Files\Yahoo!\Common\yinsthelper.dll
          O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
          O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
          O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab
          O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) -
          arcaonline.arcabit.com/ArcaOnline.cab
          O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
          O17 - HKLM\System\CCS\Services\Tcpip\..\{6A508E4E-6035-48F1-A36B-CE96CBD6F833}:
          NameServer = 194.204.152.34 217.98.63.164
          O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} -
          C:\WINDOWS\System32\vbsys2.dll (file missing)
          O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH -
          C:\Program Files\AVPersonal\AVGUARD.EXE
          O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany -
          C:\Program Files\AVPersonal\AVWUPSRV.EXE
          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
          Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32
          \IDriverT.exe
          O23 - Service: iPodService - Apple Computer, Inc. - C:\Program
          Files\iPod\bin\iPodService.exe



          • Gość: k Re: Sprawdzanie loga hijack this IP: *.warszawa.sdi.tpnet.pl 05.12.05, 19:30
            Usun jeszcze to:

            O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
            O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
            O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab
            O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
            O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} -
            C:\WINDOWS\System32\vbsys2.dll (file missing)
            • Gość: Madalenka Re: Sprawdzanie loga hijack this IP: *.neoplus.adsl.tpnet.pl 05.12.05, 23:19
              Czesc
              Dzieki za pomoc czy teraz jest juz ok??
              Pozdrawiam

              Logfile of HijackThis v1.99.1
              Scan saved at 23:18:39, on 2005-12-05
              Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
              MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

              Running processes:
              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\system32\spoolsv.exe
              C:\WINDOWS\Explorer.EXE
              C:\Program Files\AVPersonal\AVGUARD.EXE
              C:\Program Files\AVPersonal\AVWUPSRV.EXE
              C:\WINDOWS\System32\svchost.exe
              C:\Program Files\AVPersonal\AVGNT.EXE
              C:\Program Files\iTunes\iTunesHelper.exe
              C:\PROGRA~1\DAP\DAP.EXE
              C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
              C:\Program Files\Logitech\ImageStudio\LogiTray.exe
              C:\Program Files\Winamp\winampa.exe
              C:\Program Files\iPod\bin\iPodService.exe
              C:\WINDOWS\System32\wuauclt.exe
              C:\Program Files\Messenger\msmsgs.exe
              C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
              C:\Program Files\MarBit\ALLPlayer\ALLPlayer.exe
              C:\Program Files\Avant Browser\avant.exe
              C:\Documents and Settings\magda\Pulpit\hijackthis\HijackThis.exe

              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
              www.interia.pl/
              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
              O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
              C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
              O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1
              \SPYBOT~1\SDHelper.dll
              O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} -
              C:\Program Files\Yahoo!\Common\yiesrvc.dll
              O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} -
              C:\Program Files\Yahoo!\Common\YIeTagBm.dll
              O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
              C:\WINDOWS\System32\msdxm.ocx
              O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
              O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -
              atboottime
              O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
              O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP
              O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3
              \LVCOMS.EXE
              O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program
              Files\Logitech\ImageStudio\ISStart.exe
              O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program
              Files\Logitech\ImageStudio\LogiTray.exe
              O4 - HKLM\..\Run: [Onet.pl AutoUpdate] C:\Program Files\Common
              Files\Onet.pl\NewAutoUpdate.exe /tsr
              O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
              O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
              O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!
              \Messenger\ypager.exe" -quiet
              O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
              O4 - Global Startup: Adobe Reader Speed Launch.lnk = ?
              O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840
              \dslmon.exe
              O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
              O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!
              \Common/ycsrch.htm
              O8 - Extra context menu item: Blokuj wszystkie obrazy z tego serwera -
              C:\Program Files\Avant Browser\AddAllToADBlackList.htm
              O8 - Extra context menu item: Dodaj do listy blokowanych reklam - C:\Program
              Files\Avant Browser\AddToADBlackList.htm
              O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1
              \DAP\dapextie2.htm
              O8 - Extra context menu item: Otwórz wszystkie adresy z tej strony... -
              C:\Program Files\Avant Browser\OpenAllLinks.htm
              O8 - Extra context menu item: Podświetl - C:\Program Files\Avant
              Browser\Highlight.htm
              O8 - Extra context menu item: Szukaj - C:\Program Files\Avant Browser\Search.htm
              O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program
              Files\Yahoo!\Common/ycdict.htm
              O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!
              \Common/ycmap.htm
              O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!
              \Common/ycsms.htm
              O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} -
              C:\Program Files\Yahoo!\Common\yiesrvc.dll
              O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} -
              C:\Program Files\IrfanView\Ebay\Ebay.htm
              O15 - Trusted Zone: arcaonline.arcabit.com
              O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage
              Validation Tool) - go.microsoft.com/fwlink/?linkid=39204
              O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) -
              C:\Program Files\Yahoo!\Common\yinsthelper.dll
              O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) -
              arcaonline.arcabit.com/ArcaOnline.cab
              O17 - HKLM\System\CCS\Services\Tcpip\..\{6A508E4E-6035-48F1-A36B-CE96CBD6F833}:
              NameServer = 194.204.152.34 217.98.63.164
              O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH -
              C:\Program Files\AVPersonal\AVGUARD.EXE
              O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany -
              C:\Program Files\AVPersonal\AVWUPSRV.EXE
              O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
              Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32
              \IDriverT.exe
              O23 - Service: iPodService - Apple Computer, Inc. - C:\Program
              Files\iPod\bin\iPodService.exe

              • Gość: k tak b/t IP: *.warszawa.sdi.tpnet.pl 05.12.05, 23:28
    Inne wątki na temat:

    Najnowsze z forum Wirusy, trojany, spyware

    Nie masz jeszcze konta? Zarejestruj się

    Nakarm Pajacyka
    Osoby zamieszczające wypowiedzi naruszające prawo lub prawem chronione dobra osób trzecich mogą ponieść z tego tytułu odpowiedzialność karną lub cywilną. Regulamin
    Treści z serwisów internetowych Grupy Wyborcza.pl oraz serwisu tokfm.pl prezentujemy w ramach komercyjnej współpracy z ich wydawcami: Wyborcza sp. z o.o. oraz Grupą Radiową Agory sp. z o.o.